Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | 2.6.12 (including) | 3.2.53 (excluding) |
| Linux_kernel | Linux | 3.3 (including) | 3.4.69 (excluding) |
| Linux_kernel | Linux | 3.5 (including) | 3.10.19 (excluding) |
| Linux_kernel | Linux | 3.11 (including) | 3.11.8 (excluding) |